2

I setup MS DirectAccess nearly a year ago, which required configuring computer certificate auto-enrollment. The first computer certificate is going to expire in about a month, and now I'm wondering how that's going to work for machines that are never locally connected to the domain.

The auto-enrollment policy includes automatic renewal. So my question is, when does the renewal take place? If a certificate expires, then it seems to me that the DA connection will stop working, and the renewal won't be able to take place.

I apologize, my knowledge of certificates on Windows (or anywhere) is extremely limited. Thanks

Improve this question
3
  • The da connection doesn't stop because renewal happens before expiration.
    – Jim B
    Jan 5, 2015 at 18:25
  • Thanks Jim - I think that the more important part of my question then is: when is the renewal period? I realize that's not specific to DA, though I think I should leave my question as is because this is an important consideration in a DA implementation for those not already setup to do machine certificates.
    – Boden
    Jan 5, 2015 at 19:17
  • see the answer below for renewal periods. Additionally you should set the autoenrollment logging to log events and show notifications if for some reason you get close to the end of validity without renewal.
    – Jim B
    Jan 5, 2015 at 19:49

3 Answers 3

Reset to default
2

DA machines, by definition, are connected to the domain. They get their GPOs and all other things exactly as if they were on-site.

As long as you have automatic renewal with a percentage period long enough that people won't get locked out (longer than a weekend or planned company downtime), you should be good. Here's a screenshot of the relevant GPO setting.

http://1.bp.blogspot.com/-IpzPPsHHQ14/UfLwHEeJE_I/AAAAAAAAASg/qUYAP3GRxtA/s1600/Auto+Enrollment.png

/Edit - Aha. The PKI I was looking at was not showing this, but I found it online. Here's the portion of the Cert Template that must also be set : Renewal Period, on the General tab. It's likely that the GPO setting above is irrelevant for the purposes of autoenrollment and renewal.

If your current certs are built from a template without the desired value for this setting, you'll need to edit or make a new template and reissue certs, but the DA certs defaults ought to be fairly sensible.

http://i.technet.microsoft.com/dynimg/IC195087.gif

Improve this answer
5
  • thanks for clarification about DA. I didn't work with DA yet and didn't know that DA client is always connected to the domain. Then my post is valid and no web services are required.
    – Crypt32
    Jan 5, 2015 at 18:28
  • Yeah, DirectAccess is an always-on machine-to-network HTTPS VPN that uses workstation certs plus the user's logon credentials.
    – mfinni
    Jan 5, 2015 at 18:30
  • mfinni - this is good info! However, that GPO setting indicates that it will log and show notifications. It does not (based on the description) indicate that this is when machines will attempt to renew. CryptoGuy's answer states that the renewal "setting" is in the certificate template. Can someone clarify? I'm glad to learn that my assumption was correct, and that we'll need to make sure that all of our DA machines come online within their renewal periods....seems likely they would, but!
    – Boden
    Jan 5, 2015 at 19:12
  • see my edit. I added a picture and selected target setting.
    – Crypt32
    Jan 5, 2015 at 19:27
  • Heh - I added a link as well, same GUI.
    – mfinni
    Jan 5, 2015 at 19:29
3

1) certificate renewal will be triggered at the timespan specified in the certificate template prior to certificate expiration. If fails, autoenrollment client will attempt to renew certificate periodically.

enter image description here

in a given example, autoenrollment will make first attempt to renew certificate 6 weeks prior to certificate expiration.

2) In order to renew certificate, client must be able to connect domain controllers and CA server(s) via RPC/DCOM.

3) make sure if clients have Read, Enroll and Autoenroll permissions on Target certificate template.

Improve this answer
4
  • 1
    Since the client machines are using DA, they are on the internal network. A publicly-exposed cert enrollment website might be a good idea for users who slip through the cracks.
    – mfinni
    Jan 5, 2015 at 18:26
  • sorry for my ignorance in DA questions.
    – Crypt32
    Jan 5, 2015 at 18:29
  • No worries - your answer is not incorrect at all. If a workstation were off the domain long enough that the cert expired, DA would indeed fail to connect and the workstation would no longer be able to renew against an internal CA.
    – mfinni
    Jan 5, 2015 at 18:31
  • Thanks CryptoGuy. Your answer is great and I appreciate the screenshot very much. I'm accepting mfinni's answer because it also addresses the DA aspect. Wish I could accept both!
    – Boden
    Jan 5, 2015 at 20:01
0

So, you have your settings correct. But by what trigger is your client verifying that the certificate is within it's renewal period (less than 6 weeks from expiry as shown above)? This is scheduled task that runs after logon and every eight hours after that. See task scheduler, Microsoft\Windows\CertificateServicesClient\UserTask. Under Action you will see Custom Handler from which you cannot get much more detail. What is does is run dimsjob.dll as can be seen from the output of schtasks /query /XML /TN "\Microsoft\Windows\CertificateServicesClient\UserTask"

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .